VST3 wrapper turning the body of Sysex to all CD

Audio Plugins
1

I am creating short (9 bytes total) Sysex messages in a plugin, the same way I do in the standalone app (with JUCE) to send to a synthesizer. Sending it from the plugin, what I get on the host side is F0 CD CD CD CD CD CD CD F7.
What I created was:

	unsigned char MidiBuf[100];
		MidiBuf[0] = 0xf0;
	//	MidiBuf[1] = 'G';
	//	MidiBuf[2] = 'B';
	//	MidiBuf[3] = 'C';
	//	MidiBuf[4] = 'C';
		MidiBuf[1] = 1; // changed to 1,2,3,4 to see what was getting through
		MidiBuf[2] = 2;
		MidiBuf[3] = 3;
		MidiBuf[4] = 4;

		MidiBuf[5] = *data;   // my three real bytes I need through
		MidiBuf[6] = *(data+1); 
		MidiBuf[7] = *(data+2); 
		MidiBuf[8] = 0xf7;
		MidiMessage message2 = MidiMessage(MidiBuf,9);

This works fine outside of a plugin.
From the plugin I do get the sysex message back, but all intermediate bytes are 205.
I traced it through to where the VST3 wrapper is converting the messages and it appears to be getting the data pointer and the length to put in the steinberg structures. The length is coming back correct, but not the data.

Is this a bug, or is there something else I need to do to get a sysex from a plugin to the host?
The code seems to support it.
Note on and off is going through fine. But I have to also have sysex (can get around no controllers) for this project to work.
Thanks